linux-kernel - Re: Module signing and post-quantum crypto public key algorithms

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <53e81761-47e1-400e-933d-0a53018c9cab@linux.ibm.com>
Date: Thu, 19 Jun 2025 14:49:33 -0400
From: Stefan Berger <stefanb@...ux.ibm.com>
To: Simo Sorce <simo@...hat.com>,
        James Bottomley <James.Bottomley@...senPartnership.com>,
        Ignat Korchagin <ignat@...udflare.com>,
        David Howells <dhowells@...hat.com>
Cc: Herbert Xu <herbert@...dor.apana.org.au>,
        Stephan Mueller <smueller@...onox.de>, torvalds@...ux-foundation.org,
        Paul Moore <paul@...l-moore.com>, Lukas Wunner <lukas@...ner.de>,
        Clemens Lang <cllang@...hat.com>, David Bohannon <dbohanno@...hat.com>,
        Roberto Sassu <roberto.sassu@...wei.com>, keyrings@...r.kernel.org,
        linux-crypto@...r.kernel.org, linux-security-module@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: Module signing and post-quantum crypto public key algorithms



On 6/16/25 1:27 PM, Simo Sorce wrote:
> 
> Of course we can decide to hedge *all bets* and move to a composed
> signature (both a classic and a PQ one), in which case I would suggest
> looking into signatures that use ML-DSA-87 + Ed448 or ML-DSA-87 + P-521
> ,ideally disjoint, with a kernel policy that can decide which (or both)
> needs to be valid/checked so that the policy can be changed quickly via
> configuration if any of the signature is broken.
> 

FYI: based on this implementation of ML-DSA-44/65/87

https://github.com/IBM/mlca/tree/main/qsc/crystals

(entry point is mlca_verify)

I created a prototype of a kernel driver for mldsa-44/65/87 that can 
verify self-signed mldsa certs created with this openssl command:

openssl \
	req \
	-x509 \
	-newkey mldsa44 \
	-keyout localhost-mldsa44.key \
	-subj /CN=localhost \
	-addext subjectAltName=DNS:localhost \
	-days 30 \
	-nodes \
	-out localhost-mldsa44.crt

(it seems to use the shake256 hash by default)

https://github.com/stefanberger/linux-ima-namespaces/commits/mldsa.06092025/

There's lots of cleanup needed, but with a test suite in user space, 
this should not be too difficult.